Failing to update SSL Certificate in Custom domain of API Management service

Dan Ditchburn 20 Reputation points
2026-05-26T10:12:19.6666667+00:00

Hello,

We have a Standard V2 API gateway configured with a custom domain with the certificate held in Key Vault. The certificate was coming up for expiry so we've updated the certificate in Key Vault but APIM doesn't seem to be able to update for some reason.

We are seeing "Hostname certificate rotation failed" in the advisor recommendations and in the Activity Log I see:
AUTO UPDATE SSL CERTIFICATE CHECK FAILED - looking into the detail it's got:


    "properties": {
        "description": "Checking for updated Custom SSL Certificates in KeyVault Failed.",
        "errorCode": "ServiceLocked",
        "message": ""
    },

This has been ongoing for a couple of weeks now and resulted in us having to update our application gateway to use the built-in APIM URL as a workaround. I'm not sure why it's stuck in "ServiceLocked" - the Status is "Online" and there are no resource locks configured.

All Key Vault access policies are correct (and this was all working without issue).

I've tried:

  • Clicking Sync Certificates
  • Updating the custom domain to use a differently named certificate in Key Vault
  • Trying to use a manually uploaded certificate

In all cases the gateway goes into "Updating" status - and then just goes back to displaying the old custom domain, referencing the now expired certificate.

I'd really appreciate any help.

Best regards,

Dan

Azure API Management
Azure API Management

An Azure service that provides a hybrid, multi-cloud management platform for APIs.

0 comments

Answer accepted by question author

Sina Salam 31,056 Reputation points Volunteer Moderator
2026-05-26T15:42:55.98+00:00

Hello Dan Ditchburn,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

I understand that you are failing to update SSL Certificate in Custom domain of API Management service.

Your APIM Standard v2 instance is not just failing to auto-rotate the Key Vault certificate, it is stuck in a service-level infrastructure transition (ServiceLocked). That is why Key Vault sync, switching certificate reference, and even manual upload all roll back.

First verify that certificate stored as a Key Vault certificate, APIM managed identity has secret read access (Get + List for access-policy vaults, or Key Vault Certificate User for RBAC vaults), and if Key Vault firewall is enabled use system-assigned identity with Trusted Microsoft Services enabled and the required network settings.

Then use APIM Custom domains > View sync logs and Sync certificates. If ServiceLocked persists or updates still revert, stop retrying portal changes and open an Azure technical support request for APIM, asking Microsoft to clear the stuck backend service transition and repair/re-run hostname certificate synchronization.

Keep Application Gateway on the built-in *.azure-api.net hostname only as a temporary workaround until the backend lock is cleared and the custom domain presents the renewed certificate. All the links below are for more reading and steps:

I hope this is helpful! Do not hesitate to let me know if you have any other questions, steps or clarifications.

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful.

Was this answer helpful?

1 person found this answer helpful.

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Pravallika KV 18,675 Reputation points Microsoft External Staff Moderator
    2026-05-26T11:16:53.6733333+00:00

    Hi @Dan Ditchburn ,

    Even though you’ve updated the cert in Key Vault and run Sync Certificates, APIM keeps pulling the old (expired) version and logging a “ServiceLocked” error.

    Here are the most common root causes and what to check/fix:

    1. Verify you’re referencing the secret without a version
      • APIM only auto-rotates when you point at the secret container (e.g. https://myvault.vault.azure.net/secrets/apim-host-cert) not a specific version URL (…/secrets/apim-host-cert/1234abcd).
      • If you used a versioned URL, update the Custom Domain to use the non-versioned secret and hit Save.
    2. Check the managed identity and Key Vault permissions
      • In APIM =>Managed identities, ensure the system‐assigned identity is On.
      • In Key Vault: • If you use Access Policies, grant that identity List + Get on Secrets. • If you use RBAC, assign the Key Vault Secrets User role to the APIM principal.
      • After changes, use Sync certificates and then View sync logs under your Custom Domain settings to confirm there are no “Forbidden” or auth errors.
    3. Validate network connectivity (if APIM in a VNet)
      • Ensure APIM can reach https://<your-vault>.vault.azure.net over port 443.
      • Confirm any NSGs, UDRs or Firewall rules aren’t blocking outbound traffic to the AzureKeyVault service tag.
    4. Remove any stale or “dead” secret links
      • In Key Vault remove old/expired versions or certificates you no longer need.
      • In APIM Custom Domains, delete the hostname entry, wait for it to drop, then re-add it pointing to the refreshed secret.
    5. Use the “Restore” action if you see access-issue warnings
      • In the APIM portal under Custom domains, a banner may prompt you to Restore Key Vault access. This automatically re-applies the needed permissions based on your vault’s auth model.
    6. As a last resort, file a support request
      • If you’ve verified the above and still see “ServiceLocked” in the activity logs, there may be a service-side lock or degraded state that only Microsoft support can clear.

    Was this answer helpful?

    1 person found this answer helpful.

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.